Cisco ISE zero-day (CVE-2026-76460): patch now, then hunt

Cisco has released emergency fixes for CVE-2026-76460, a maximum-severity (CVSS 10.0) authentication bypass in its Identity Services Engine (ISE) that was being exploited before it was disclosed. It arrived two days after Cisco warned of a separate, actively exploited critical flaw in its Secure Email Gateway. If ISE sits in your network, this is a patch-today issue, followed by a careful look for signs that someone got there first.

What we know

According to Help Net Security and CyberScoop, the flaw lies in an ISE API endpoint that does not enforce sufficient authentication. An unauthenticated, remote attacker can send a crafted request that bypasses the web-based management interface, gaining control of the device. Cisco has confirmed exploitation in the wild but has not published technical details of the attacks. CyberScoop reports the issue was discovered during a technical support case, and that CISA has added the flaw to its Known Exploited Vulnerabilities catalogue.

Help Net Security lists the affected products as Cisco ISE and ISE Passive Identity Connector (ISE-PIC) releases 3.0 to 3.5, with fixes in:

• ISE 3.1 Patch 12
• ISE 3.2 Patch 11
• ISE 3.3 Patch 12
• ISE 3.4 Patch 7
• ISE 3.5 Patch 4

There is no workaround. Help Net Security also reports advice to move older releases to 3.3 Patch 12, 3.4 Patch 7 or 3.5 Patch 4. Always confirm the correct target release against Cisco’s own advisory for your deployment.

The second flaw, CVE-2026-76461, affects Cisco Secure Email Gateway and is also rated critical and actively exploited. Cisco told CyberScoop the two are different products and vulnerability classes with no relation.

Why ISE is such a valuable target

ISE is not just another appliance. It decides who and what is allowed onto which parts of your network. A researcher quoted by CyberScoop notes that root access on ISE would let an attacker change access policy, extract stored credentials, delete logs and move laterally into the segments ISE controls. In other words, compromise of the gatekeeper can quietly undermine every segmentation control that depends on it.

This is also the latest in a series of critical ISE flaws; CyberScoop notes two critical ISE vulnerabilities disclosed in June 2025. Repeated high-severity issues in the same product family should feed into your risk register and architecture decisions, not just your patch queue.

What to do now

1. Find every ISE and ISE-PIC node. Include lab, disaster recovery and forgotten instances. Check Secure Email Gateway exposure at the same time.
2. Upgrade immediately to a fixed release confirmed in Cisco’s advisory. Restrict management and API access to trusted networks while you do.
3. Hunt for compromise. Help Net Security reports Cisco’s advice to review ISE access logs for suspicious usernames and to check firewall and network logs outside the device for unexpected uploads or downloads, because attackers may delete local logs.
4. Re-image if in doubt. Where compromise is suspected, rebuild affected nodes and restore configuration from a known-good backup, then rotate credentials ISE stored or used.
5. Record the decision trail. Log when you learned of the flaw, when you patched and what you checked. Under frameworks such as NIS2, DORA and ISO 27001, that evidence matters as much as the fix.
6. Test your assumptions. After patching, validate that segmentation and access policies still behave as designed.

Praeferre’s penetration testing team can validate network access controls and segmentation after an incident like this, and our GRC automation platform links vulnerability response to the controls and evidence auditors and regulators expect.

Common questions

Sources

1. Unauthenticated attackers are bypassing Cisco ISE’s management interface (CVE-2026-76460) — Help Net Security, 17 September 2026
2. Cisco alerts customers to second actively exploited zero-day in as many days — CyberScoop, 17 September 2026